Texting customers in other countries: what changes at the border

The rule that catches people out is simple and expensive: the law that applies is generally the one where the recipient is, not where you are. A single customer with a Canadian number brings Canadian rules into your compliance surface, whatever your business address says.

The broad strokes by region

• United States. Marketing texts need express written consent that you can prove. Opt-out keywords must work automatically. Traffic on standard numbers needs carrier registration, and time-of-day restrictions apply in the recipient's zone.
• Canada. Notably stricter. Anti-spam legislation requires consent with specific record-keeping, mandates clear sender identification and an unsubscribe mechanism in commercial messages, and carries meaningful per-violation penalties.
• United Kingdom and EU. Consent must be freely given, specific, informed and unambiguous — a pre-ticked box is not consent. Data protection rules apply on top: people can ask what you hold about them and ask you to delete it.
• Australia. Commercial messages need consent, accurate sender identification, and a working unsubscribe facility.
• Elsewhere. Assume there are rules, assume they are at least as strict as the US, and confirm with your provider before you send.

Design for the strictest rule you touch

Building a different consent flow per jurisdiction is how small teams create bugs that become violations. Pick the strictest regime among your markets and apply it everywhere. It costs you a slightly lower opt-in rate and removes an entire category of risk.

type ConsentRecord = {
  phone: string;                  // E.164 — the country code is your jurisdiction hint
  jurisdiction: string;           // resolved at capture, stored, never re-derived later
  status: "opted_in" | "opted_out";
  scope: "marketing" | "transactional";
  capturedAt: string;
  disclosureText: string;         // the exact wording shown, in the language shown
  language: string;
  source: string;
  // Some regimes expire consent after a period of inactivity.
  expiresAt: string | null;
};

Practical mechanics

1. 01Store every number in E.164. The country code is how you resolve jurisdiction, time zone and routing. Normalise on capture, not on send.
2. 02Send in the recipient's local time. An 8am message is a 3am message somewhere. Scheduling across zones.
3. 03Recognise opt-out words in the local language, not just English. Someone replying 'ARRÊT' has opted out and your regex should know it.
4. 04Check whether your provider even delivers to that country, and at what rate. International SMS pricing varies enormously and iMessage coverage does not map to carrier coverage.
5. 05Keep the disclosure text you actually showed, in the language you showed it. 'They accepted our terms' is not a record.

Where WhatsApp changes the calculation

In markets where WhatsApp is the default channel, an SMS from an unknown number reads as suspicious in a way it does not in the US. If a meaningful share of your list sits in those markets, the channel question matters more than the compliance question — iMessage vs WhatsApp.